Director, Product Security, PSIRT
Okta · Bellevue, Washington; San Francisco, California
About this role
**Secure Every Identity, from AI to Human** Okta secures AI by building trusted, neutral infrastructure that helps organizations safely embrace the next era of technology. Within Product Security, the Product Security Incident Response Team (PSIRT) owns Okta’s response when a security vulnerability is reported, exploited, or puts customers at risk across Okta, Auth0, and the systems they run on. As **Director, Product Security, PSIRT**, you’ll lead PSIRT through a rapidly changing vulnerability landscape—scaling day-to-day incident response, building the team and agentic workflows that enable scale, and serving as a steady, credible voice when vulnerabilities matter to customers. --- ### What You Will Do - Lead Okta’s PSIRT program across all business units: define strategy, roadmap, and operating model - Own the vulnerability-handling lifecycle (intake/triage → remediation → coordinated disclosure → post-incident review) and keep procedures/runbooks current - Serve as senior incident lead on Critical and high-profile vulnerabilities, including industry-wide issues, with clear decision-making under pressure - Partner with Engineering leaders to drive fixes and hotfixes on time (engineering owns remediation) - Run coordinated disclosure with researchers/partners; own Okta’s CVE and security advisory process with Customer Trust and Security Communications - Work with Cyber Defense, Identity Defense, Legal, and Federal teams on exploitation analysis, customer impact, and regulatory obligations - Own the bug bounty program and relationships with the security research community - Scale the team with automation and AI (agentic triage, root-cause/variant analysis, and tooling for surge capacity) - Set and report KPIs (time to acknowledge, time to resolve, SLA attainment, advisory timeliness) to security and executive leadership - Brief executives clearly and proportionally to risk; lead post-incident reviews that feed lessons back into the Secure Development Lifecycle - Maintain and strengthen a culture of growth, openness, trust, rigor, humility, and mutual support - Lead recruiting for PSIRT growth plans in collaboration with recruiters - Mentor PSIRT and Product Security engineers - Represent Okta with authority in industry forums and with customers, researchers, and peer PSIRTs --- ### What You Bring - **U.S. citizenship** and eligibility to obtain **Top Secret / Sensitive Compartmented Information (TS/SCI)** clearance (active or prior clearance a plus) - Ability to travel as needed and maintain availability for off-hours incident response escalation - Extensive background in product security incident response or vulnerability management, including leadership/managerial experience - Proven track record managing geographically distributed teams across time zones - Hands-on experience leading high-severity vulnerability incidents (triage/impact analysis → fix validation → public disclosure) - Strong technical depth in web application, identity, and cloud vulnerabilities; ability to reproduce issues and assess exploitability and customer impact - Working knowledge of coordinated disclosure and vulnerability handling standards (ISO/IEC 29147 & 30111, FIRST PSIRT Services Framework) and of CVE/CVSS - Experience running or working closely with a bug bounty program - Working knowledge of compliance frameworks (SOC2, PCI, FedRAMP, etc.) - Exceptional communication and influence skills to articulate vulnerability risk to engineers, executives
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.